Red Heron Weaponizes Gitea Flaw for Source Code Theft
In a matter of mere days, a publicly disclosed exploit targeting Gitea rapidly metamorphosed into an industrialized instrument for source code theft. The Red Heron threat group ruthlessly automated the discovery of vulnerable servers, account registration, remote command execution, repository exfiltration, and partial forensic cleanup. Following a successful breach, the attackers deployed highly stealthy malicious toolkits directly onto compromised Linux systems.
Exploiting CVE-2026-60004
The primary point of entry was the critical vulnerability designated CVE-2026-60004, which boasts a devastating CVSS score of 9.8. This flaw specifically afflicts Gitea versions ranging from 1.17 to 1.27.0. It permits an adversary, via the diffpatch API, to implant a malicious Git hook that executes with the elevated privileges of the Gitea system account. Technically, the attacker requires repository write access; however, standard open registration allows any individual to unilaterally create an account and acquire the necessary permissions. The potent combination of open registration and remote code execution has historically transformed Git servers into convenient gateways for external threat actors.
According to research detailing how Red Heron exploits a Gitea N-day flaw in a multinational campaign, the group commenced refining a published Proof of Concept (PoC) on July 29, just one day following the disclosure of the vulnerability’s technical specifics. By July 30, the operator had already scanned 1,386 Gitea servers across seven nations utilizing 50 concurrent threads, subsequently isolating a distinct database of 477 Taiwanese systems. From this aggregate sample, 128 servers featuring open registration were immediately relegated to a priority targeting list.
Automated Exploitation and Data Exfiltration
The subsequent iteration of their tool, exp_enhanced.py, functioned akin to a relentless assembly line. The script ingested a target list, autonomously registered ephemeral accounts, initiated the exploit, illicitly copied repositories directly from the file system, and scrubbed portions of its operational footprint from the Gitea database. This specific attack vector proves exceptionally hazardous to development infrastructure because repositories and configuration files frequently harbor sensitive tokens, SSH keys, and other critical secrets alongside the source code.
Upon breaching a Taiwanese industrial automation firm, Red Heron successfully exfiltrated hundreds of repositories containing SCADA/HMI components, IoT integrations, network analyzer software, server configurations, and proprietary internal applications. From a Canadian renewable energy enterprise, the attackers compromised the HR system, CRM, authentication services, internal APIs, JWT tokens, and SSH keys. In a separate incident, the initial Gitea compromise culminated in full root access to a three-node Proxmox cluster, allowing the attackers to initiate illicit backups of virtual machines.
The JITTERLY Implant and SIXZUT Rootkit
The subsequent investigation directed specialists toward a sophisticated C++ Linux implant dubbed JITTERLY. This malware supports over 30 distinct commands, encompassing shell execution, file transfer, an interactive terminal, SOCKS tunneling, port forwarding, and lateral network movement. Concealed within JITTERLY was a previously undocumented rootkit named SIXZUT. This component leverages the LD_PRELOAD mechanism, compelling dynamically linked Linux processes to surreptitiously load the malicious library.
SIXZUT effectively intercepts 15 core Linux functions, meticulously obscuring files, processes, and network connections. The rootkit filters information originating from /proc and actively interferes with Netlink responses, enabling it to conceal connections even from the ss utility. Furthermore, the intercepted kill function prevents the termination of the protected process using a standard kill -9 command. Should JITTERLY vanish from memory, SIXZUT possesses the capability to spontaneously relaunch the implant. This operational methodology elevates the rootkit from a mere concealment tool into a resilient self-healing mechanism for the malware.
Attribution and Remediation Advice
Acronis currently associates Red Heron with a Chinese-speaking environment with moderate confidence. On an intermediary server, investigators discovered target databases categorized in Simplified Chinese, alongside a specific classification system for defense, energy, elections, aerospace, and government entities. However, analysts have not yet established a definitive link between Red Heron and any previously identified APT group.
Security experts strongly advise Gitea administrators to immediately upgrade to at least version 1.27.1, decisively disable open registration where unnecessary, rigorously audit access logs for the diffpatch API, and treat any potentially compromised tokens or SSH keys as entirely exposed. Upon detecting the presence of SIXZUT, specialists recommend completely rebuilding the server from a trusted, pristine image rather than attempting to surgically cleanse the infected operating system. Because the rootkit adeptly conceals its own files from standard user utilities, administrators must verify /etc/ld.so.preload and actively hunt for other infection indicators strictly from a demonstrably clean environment.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
